Hi,

it would be also usefull to have an extra permission to 'delete attached images'. Actually any user that can create images (ie: authenticated users) can also delete all previously attached ones.

Thanks

CommentFileSizeAuthor
#5 node_images_3.patch7.38 KBstefano73
#4 node_images_2.patch3.43 KBstefano73
#3 node_images_0.patch2.4 KBstefano73

Comments

stefano73’s picture

stefano73 commented

Actually I can't figure out why a user who can upload images should not be allowed to delete those images. What if a user uploads a wrong image? He wouldn't be able to delete it.
I think that a user who can update a node should have no restriction on the images uploaded for that node. If you take a look at the permissions in upload.module, you'll see "upload files" and not "delete uploaded files".

marcoBauli’s picture

marcoBauli commented

personally i think a 'delete images' permission is usefull to prevent dull hackers or unfair competitors to ruin a site by deleting it's pictures, as well as to prevent users from deleting them accidentally (both are 2 situations that unfortunately are very likely to happen)

What if a user uploads a wrong image?

good point.. admins or moderators can delete it, or even better maybe there could be a third 'delete own images' permission ;P ?

stefano73’s picture

stefano73 commented
StatusFileSize
new node_images_0.patch2.4 KB

I disabled the "delete" checkboxes for users who don't have the permission to delete the node (when user_acess("delete", $node) is FALSE). This way users who are not allowed to delete nodes won't be allowed to delete node images as well.

stefano73’s picture

stefano73 commented
StatusFileSize
new node_images_2.patch3.43 KB

I made a mistake, sorry. The correct function to test node access is node_access(), not user_access().
Updated patch attached.

stefano73’s picture

stefano73 commented
Status: Active » Needs review
StatusFileSize
new node_images_3.patch7.38 KB

New patch attached.

stefano73’s picture

stefano73 commented
Status: Needs review » Closed (fixed)

Committed to CVS.